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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

Claims 1-22 (Canceled) 

23. (New) A method in a computer system for detecting intrusions during a bootstrapping 
phase of an intrusion detection system, the method comprising: 

storing a behavior profile associated with an application, the behavior profile having been 
generated, prior to operation of the application on the computer system that detects intrusions 
during a bootstrapping phase of an intrusion detection system, by any one of: 

executing the application on a reference computer system other than the computer 
system for detecting intrusions during a bootstrapping phase of an intrusion detection system; 
heuristic determination; and 

a combination of executing the system on the reference computer system and heuristic 
determination, and wherein the stored behavior profile is at least one of encrypted and digitally 
signed; 

reading, with the computer system during a bootstrapping phase of an intrusion detection 
system, the stored behavior profile associated with the application; 

monitoring execution of the application at the computer system during the bootstrapping 
phase, according to the behavior profile; and 

if the behavior of the application does not conform to the behavior profile, issuing a 
message indicating that the application is not conforming to the behavior profile. 
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24. (New) A computer readable storage medium storing computer instructions for detecting 
intrusions during a bootstrapping phase of an intrusion detection system, the computer 
instructions including instructions for: 

storing a behavior profile associated with an application, the behavior profile having been 
generated, prior to operation of the application on the computer system that detects intrusions 
during a bootstrapping phase of an intrusion detection system, by any one of: 

executing the application on a reference computer system other than the computer 
system for detecting intrusions during a bootstrapping phase of an intrusion detection system, 

heuristic determination, and 

a combination of executing the system on the reference computer system and 
heuristic determination, and wherein the stored behavior profile is at least one of encrypted and 
digitally signed; 

reading, with the computer system during a bootstrapping phase of an intrusion detection 
system, the stored behavior profile associated with the application; 

monitoring execution of the application at the computer system during the bootstrapping 
phase, according to the behavior profile; and 

if the behavior of the application does not conform to the behavior profile, issuing a 
message indicating that the application is not conforming to the behavior profile. 
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25. (New) A computer system capable of detecting intrasions during a bootstrapping phase 
of an intrusion detection system, comprising: 

a first memory for storing an application; 

a second memory for storing a behavior profile associated with the application, the 
behavior profile having been generated, prior to operation of the application on the computer 
system that detects intrusions during a bootstrapping phase of an intrusion detection system, by 
any one of: 

executing the application on a reference computer system other than the computer 
system for detecting intrusions during a bootstrapping phase of an intrusion detection system, 
heuristic determination, and 

a combination of executing the system on the reference computer system and 
heuristic determination, and wherein the stored behavior profile is at least one of encrypted and 
digitally signed; 

a monitor, communicatively coupled with the first memory and the second memory, for 
reading, with the computer system during a bootstrapping phase of an intrusion 
detection system, the stored behavior profile associated with the application, and 

monitoring execution of the application at the computer system during the 
bootstrapping phase, according to the behavior profile; and 

a warning module, communicatively coupled with the monitor, for issuing a message 
indicating that the application is not conforming to the behavior profile. 
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